ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Published Apr 3, 2025 · catalog updated Aug 3, 2026 · Ivanti Connect Secure, Policy Secure, and ZTA Gateways

Patch now

CVE-2025-22457 is in the CISA known-exploited catalog, due Apr 11, 2025. Confirm Ivanti Connect Secure, Policy Secure, and ZTA Gateways against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
Critical9.8
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
99.98%
Remediation
Remediation guidance
Affected products
cpe ivanti/connect secure · vendor Ivanti Connect Secure, Policy Secure, and ZTA Gateways

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe ivanti/connect secure22.7
  • vendor Ivanti Connect Secure, Policy Secure, and ZTA Gatewaysversion unspecified

How to fix CVE-2025-22457

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-22457 is in the CISA known-exploited catalog, due Apr 11, 2025. Confirm Ivanti Connect Secure, Policy Secure, and ZTA Gateways against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with ivanti/connect secure 22.7. Apply mitigations as set forth in the CISA instructions linked below.

What should an analyst verify?

CWE-121: Stack-based Buffer Overflow; CWE-787: Out-of-bounds Write. EPSS 99.98%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 3, 2025 · Catalog

    Detected

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

  2. Apr 4, 2025 · CISA KEV

    Known exploited

    Apply mitigations as set forth in the CISA instructions linked below.

  3. Apr 11, 2025 · CISA KEV

    Remediation due

    Apply mitigations as set forth in the CISA instructions linked below.

  4. Aug 3, 2026 · Catalog

    Updated

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Sources

  • CISA KEVConfirmed exploitationCVE-2025-22457

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2025-22457

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-22457

    30-day exploitation probability 100.0%

    first.org
  • Metasploit ModulesPublic exploit moduleexploit_linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457

    Public module reference (great). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2025-22457

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2025-22457

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.